MySQL SSL连接报错DH密钥过小：RHEL8/9 MySQL连RHEL6 MySQL失败排查

连接部署在RHEL6（openssl-1.0.1e-fips、MySQL 5.1.73）的eos3服务器时，出现以下错误：

ERROR 2026 (HY000): SSL connection error: error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small

连接命令 #

ssldir=/home/inet/devel/config/mysql_ssl

mysql \
        -vvvvv \
        -u ***** \
        -p \
        -h eos3 \
        --ssl-ca $ssldir/cacert.pem \
        --ssl-cert $ssldir/server-cert.pem \
        --ssl-key $ssldir/server-key.pem

不同服务器连接结果 #

• A）RHEL7（mariadb-5.5.68、openssl-1.0.2k-fips）：连接正常
• B）RHEL8（MySQL 8.0.26、openssl-1.1.1k FIPS）：连接失败
• C）RHEL9（mariadb-10.5.16、openssl-3.0.1）：连接正常

补充：RHEL9上的MySQL 8.0.30连接同样失败，实际需解决PHP 8.0无法与eos3建立SSL连接的问题，PHP使用PEAR.php、DB.php、mysqli_d.php。

尝试过的无效操作 #

修改/etc/pki/tls/openssl.cnf（系统无/etc/ssl/openssl.cnf文件）的以下配置，但未生效：

MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=1

eos3服务器端SSL密码套件列表 #

| Ssl_cipher_list | ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256-GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:ECDH-RSA-AES256-SHA:ECDH-ECDSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:PSK-AES256-CBC-SHA:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:DHE-DSS-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:DHE-RSA-SEED-SHA:DHE-DSS-SEED-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-DSS-CAMELLIA128-SHA:ECDH-RSA-AES128-GCM-SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-AES128- |

关键细节 #

• 证书和RSA密钥为2048位（1024位时同样连接失败）
• 成功连接时Ssl_version均为TLSv1.2
• RHEL7与RHEL9连接的Ssl Cipher分别为DHE-RSA-AES256-GCM-SHA384、AES256-GCM-SHA384

疑问与需求 #

为何MariaDB可正常连接但MySQL不行？希望解决MySQL连接问题以推动PHP 8.0连接正常。

内容的提问来源于stack exchange，提问作者John Wythe